systemd-resolved uses a built-in root DNSSEC trust anchor and never updates it automatically, so root key rollovers can break validation with "missing-key" errors. Here is why it happens and how to wire in the distributi...